Remote link or API token

An app reaches Hamloy at an address, and proves who you are with a key. There are two ways to get the key and two addresses to give it.

Two ways in

Sign in (OAuth). Give the app the address and nothing else. The first time it calls, Hamloy answers that it needs a sign-in, and says where. The app opens hamloy.com in your browser, you sign in and choose Allow, and the app keeps the key it gets back. That key lasts an hour and the app renews it by itself; if it goes unused for 90 days, the app asks you to sign in again. Claude, ChatGPT, Cursor, VS Code and Codex all do this.

The app is then listed under Connected apps on the Connect page, with when it was last used, and a Disconnect button.

An API token. For a machine where nobody can sign in: a CI job, a server, an app that can't open a browser. Make one on the Connect page under API tokens, named for what it's for ("Claude Code on my laptop"). It starts with hml_ and is shown once; Hamloy keeps only a digest of it and its last four characters, to tell it apart. The app sends it as a header:

Authorization: Bearer hml_…

Make one per machine or app, so you can revoke one without the others. See API tokens.

Either way, the key is yours: it reaches every project you are on, those you own and those shared with you. On a project shared with you to read, the tools read and refuse to change.

	Sign in	API token
What you give the app	The address	The address and the token
Who can use it	An app with a browser to open	Anything that sends a header
Lasts	Renewed by the app; 90 days unused and it asks again	Until you revoke it
Where you see it	Connected apps	API tokens

A key that is missing, unknown or revoked gets this answer, with the address to sign in from:

Missing, unknown or expired token. Sign in again from your app, or make an API token at https://hamloy.com/connect.

Two addresses

The account's: https://hamloy.com/mcp. One connection for every project you are on. Claude and ChatGPT keep one connection per account, so they use this one; so does Codex, whose settings are the same in every folder.

A project's own: https://hamloy.com/mcp/<project id>. One connection, one project. The Connect page shows it for each project. The tools need no project argument here. When the program sets up Claude Code in a folder, it gives Claude Code that folder's project address.

What changes on the account's address

The tools on a project's address know their project. On the account's address a call has to say which one, so Hamloy adds two things there and nowhere else:

• A project argument on every tool: "The project this is for: its name or id, as the projects tool lists them. Leave it out when you are on one project only." Hamloy takes it out before the call reaches the tool, which then works as on the project's own address.
• Two tools: projects (Your projects) lists them, and new_project (Start a project) starts one, for work that belongs to none yet, such as a new repo.

What projects answers:

You are on 2 projects:
- “Pebble” (yours), id 5bc785b2-a29c-47e8-a546-391e4ecc0f38
- “Pebble site” (yours), id 77896f36-f0ec-4e83-8f68-d149559151fd
Every other tool takes one of these as project, by name or id.
Work goes only in the project it belongs to. When none fits, do the work anyway and ask the human at the end which project it goes in, or start one with new_project.

With several projects, Hamloy never guesses. A call without project is answered with the choice, and a name that matches none says so:

You are on 2 projects, so say which one this is for, as project: “Pebble” or “Pebble site”. When none of them is what this work belongs to, do the work anyway and ask the human at the end which project it goes in, or start one with new_project.
You are on no project called “Pebl”. Give one of these as project: “Pebble” or “Pebble site”.

With one project, project can be left out. Someone on no project yet still gets the tools, and every call answers that they can start one with new_project.

Which to use

• Claude, ChatGPT: the account's address, signed in. See Claude and ChatGPT.
• Claude Code, Codex: the program, which signs them in for you and picks the address. See Claude Code and Codex.
• Cursor, VS Code, other apps: a project's address in the project's own settings file, signed in. It holds no secret, so the file can be committed. See Cursor and VS Code.
• CI and servers: an API token, from an environment variable, never written into a file the repo keeps.

New to all this? Start with What is MCP?.